323531 - crash when deleting all attachments after(!) detaching all of them from one mail [@ CompareAttachmentPartId]

Status: RESOLVED FIXED

(Thunderbird :: Mail Window Front End, defect)

Description

[Christian Ziemski]

User-Agent:       Opera/8.51 (Windows NT 5.0; U; en)
Build Identifier: Version 1.5 (20051201)

When I try to delete *all* attachments at once from a mail with more than one attachment after first detaching them all(!) crashes TBird. (Deleting one by one is no problem.)

[ In case the above sounds weird: First time I did that "accidently" because it wasn't clear to me that detached attachments are really gone from the mail. 
But that's another story.) ]

I tried it on two different PC. On one of them with a completely clean install of TBird.

A somehow related discussion can be found here: 
http://forums.mozillazine.org/viewtopic.php?t=359918


Reproducible: Always

Steps to Reproduce:
1. have a mail with at least 2 attachments
2. "detach all" attachments from the mail
3. "delete all" attachments from the same mail

Actual Results:  
TBird crashes hard.

Comment 1

[Magnus Melin [:mkmelin]]

Confirmed on linux. (Similar to bug 323131, so that might fix this one..)

Talkback: TB13994554X

Comment 2

[Adam Guthrie]

Incident ID: 13994554
Stack Signature	libc.so.6 + 0x2cd7c (0xb750ad7c) a7043034
Product ID	Thunderbird2
Build ID	2006010905
Trigger Time	2006-01-15 12:33:18.0
Platform	LinuxIntel
Operating System	Linux 2.6.12-10-386
Module	libc.so.6 + (0002cd7c)
URL visited	
User Comments	
Since Last Crash	1 sec
Total Uptime	6 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
libc.so.6 + 0x2cd7c (0xb750ad7c)
libc.so.6 + 0x2cb0f (0xb750ab0f)
CompareAttachmentPartId()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/src/nsMessenger.cpp, line 316]
NS_QuickSort()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/xpcom/ds/nsQuickSort.cpp, line 113]
nsAttachmentState::PrepareForAttachmentDelete()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/src/nsMessenger.cpp, line 2501]
nsMessenger::DetachAttachments()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/src/nsMessenger.cpp, line 2995]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 3091]
XPC_WN_CallMethod()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/jsinterp.c, line 3522]
js_Invoke()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_InternalInvoke()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/jsinterp.c, line 1274]
JS_CallFunctionValue()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/js/src/jsapi.c, line 4158]
nsJSContext::CallEventHandler()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1413]
nsJSEventListener::HandleEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 185]
nsEventListenerManager::HandleEventSubType()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 848]
nsEventListenerManager::HandleEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1784]
nsXULElement::HandleDOMEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2153]
PresShell::HandleDOMEventWithTarget()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/layout/base/nsPresShell.cpp, line 6469]
nsMenuFrame::Execute()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 848]
nsMenuFrame::HandleEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 454]
PresShell::HandleEventInternal()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/layout/base/nsPresShell.cpp, line 69]
PresShell::HandleEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/layout/base/nsPresShell.cpp, line 6209]
nsViewManager::HandleEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/view/src/nsViewManager.cpp, line 848]
nsViewManager::DispatchEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/view/src/nsViewManager.cpp, line 2254]
HandleEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/view/src/nsView.cpp, line 251]
nsCommonWidget::DispatchEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219]
nsWindow::OnButtonReleaseEvent()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1601]
button_release_event_cb()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 3737]
libgtk-x11-2.0.so.0 + 0x12002c (0xb7c4a02c)
libgobject-2.0.so.0 + 0x93a8 (0xb7a073a8)
libgobject-2.0.so.0 + 0x17b13 (0xb7a15b13)
libgobject-2.0.so.0 + 0x18ec3 (0xb7a16ec3)
libgobject-2.0.so.0 + 0x194c3 (0xb7a174c3)
libgtk-x11-2.0.so.0 + 0x20216f (0xb7d2c16f)
libgtk-x11-2.0.so.0 + 0x11e767 (0xb7c48767)
libgtk-x11-2.0.so.0 + 0x11eba0 (0xb7c48ba0)
libgdk-x11-2.0.so.0 + 0x3fb2d (0xb7aecb2d)
libglib-2.0.so.0 + 0x244ee (0xb799e4ee)
libglib-2.0.so.0 + 0x274f6 (0xb79a14f6)
libglib-2.0.so.0 + 0x277e3 (0xb79a17e3)
libgtk-x11-2.0.so.0 + 0x11de65 (0xb7c47e65)
nsAppShell::Run()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 848]
main()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mail/app/nsMailApp.cpp, line 63]
libc.so.6 + 0x14ea2 (0xb74f2ea2)

Comment 3

[eric]

Same problem with Windows 98 and XP. See topic in forum:
http://forums.mozillazine.org/viewtopic.php?t=386086&highlight=

Comment 4

[Magnus Melin [:mkmelin]]

It crashes since for detached attachments, partIdLeft and/or partIdRight are null  at 
http://lxr.mozilla.org/mozilla/source/mailnews/base/src/nsMessenger.cpp#2323

Not sure what the correct fix would be though...

Comment 5

[Julian Hall]

Hi,

Windows XP SP1
Thunderbird 1.5.0.4(20060516)

Thunderbird crashes when I try to delete attachments from mails using:

File -> Attachments -> Delete

This happens whether I open the mail in a new window and then try or I just select the option with the mail in the preview window.

Detach All works fine.

I've also tried deleting them singly but that doesn't work either.

Thunderbird displays the confirmation box of what is to be deleted.

Thunderbird then crashes immediately.

Also I have now found it has created duplicates of the folder I was attempting to remove attachments from with the names:

nstmp
nstmp-1
nstmp-2
nstmp-3

Incidentally, these names of course bear no relation to the original folder name.

Comment 6

[Magnus Melin [:mkmelin]]

Attachment: proposed fix

Comment 7

[David :Bienvenu]

is this crash still on the trunk? I thought I fixed it already...

Comment 8

[Magnus Melin [:mkmelin]]

Sure is, i just crashed - talkback id TB22893093Z

It's enough if you "Delete all..." if at least one of the attachments is detached.

Comment 9

[Julian Hall]

Now on Tbird 1.5.0.5.  Identical to my original report and it's still creating that weird nstmp folder on restart duplicating the content of the folder the original email was in.

Problem still exists.

Comment 10

[David :Bienvenu]

Comment on attachment 236724 [details] [diff] [review]
proposed fix

sorry for the delay. Thx for the patch!

Comment 11

[Magnus Melin [:mkmelin]]

Comment on attachment 236724 [details] [diff] [review]
proposed fix

Do you want to sr and maybe check it in also?

Comment 12

[David :Bienvenu]

fixed on trunk and branch, thx, Magnus.

Comment 13

[David :Bienvenu]

Comment on attachment 236724 [details] [diff] [review]
proposed fix

getting off request q.

Comment 14

[Daniel Veditz [:dveditz]]

Comment on attachment 236724 [details] [diff] [review]
proposed fix

approved for 1.8.0 branch, a=dveditz for drivers

Comment 15

[David :Bienvenu]

fixed for 1.8.0.8

Comment 16

[Jay Patel [:jay]]

Can folks please try reproducing this with a recent Thunderbird nightly builde (ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly) and see if the crash is fixed?  If so, please update the fixed1.8.0.8 keyword with verified1.8.0.8.  Thanks!

Comment 17

[Carsten Book [:Tomcat]]

v. for 1.8.0.8 Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.8) Gecko/20061024 Thunderbird/1.5.0.7 ID:2006102408

Comment 18

[Carsten Book [:Tomcat]]

verified fixed for 1.8.1.3 using Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 ID:2007032620 (Thunderbird 2 RC1). No Crash at the Steps to reproduce provided in this bug.

Comment 19

[Julian Hall]

Am now using (on Windows) 1.5.0.11.  Deleted dozens of attachments yesterday (savng myself 600Mb in the process!) with no crashes.  This seems to have fixed the bug for the Windows version.